jaffacakes118_Trojan-GameThief[.]Win32[.]Magania[.]dloh[.]ea3d4fa64ac75a330fa9f581cf467c48

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-GameThief.Win32.Magania.dloh.ea3d4fa64ac75a330fa9f581cf467c48
Size 48KB
Sample261006-t1b2caay4y
SHA256 993e3ed43dce7f7657feeae31b2fd256f445ac29452417b030aa8e8f702b17a0
MD5 ea3d4fa64ac75a330fa9f581cf467c48
SHA1 4851cc2678334a110c33ee3e910e7369a2eae2b3
SHA512 47d532f3b55b5da6c43665c5d7dbd46281b321dc45715305088fbe42c5fb524fc97ac212dbe0371ad09d955a784300344414e93298f29369a3321f6e5826164e
SSDEEP 768:k3a77UFb09KUJrPt3Zq1oNMFX47+qKVKlMaBQ7VP4vPNCHwKcx9VY/:R3g1oOFcA4vPcHu9u/
TLSH
T17A2319239B9D44E1E647B93A78A93BA7C66D501967E42DD79FA33D90043B3F0A031B0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Magania.dloh.ea3d4fa64ac75a330fa9f581cf467c48

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Magania.dloh.ea3d4fa64ac75a330fa9f581cf467c48

.dll 48KB

jaffacakes118_Trojan-GameThief.Win32.Magania.dloh.ea3d4fa64ac75a330fa9f581cf467c48

IMPHASH d0142eb266e70fb8cebcad9fec22e5c8
SHA256 993e3ed43dce7f7657feeae31b2fd256f445ac29452417b030aa8e8f702b17a0
MD5 ea3d4fa64ac75a330fa9f581cf467c48
SHA1 4851cc2678334a110c33ee3e910e7369a2eae2b3
SHA512 47d532f3b55b5da6c43665c5d7dbd46281b321dc45715305088fbe42c5fb524fc97ac212dbe0371ad09d955a784300344414e93298f29369a3321f6e5826164e
SSDEEP 768:k3a77UFb09KUJrPt3Zq1oNMFX47+qKVKlMaBQ7VP4vPNCHwKcx9VY/:R3g1oOFcA4vPcHu9u/
TLSH
T17A2319239B9D44E1E647B93A78A93BA7C66D501967E42DD79FA33D90043B3F0A031B0D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

i:\1传奇外传资料\A备份\1移动单\lele二代\m16魔兽世界VC2005\wow防D-TT版\wowpic\release\MWDL.pdb

kernel32

lstrcpynA CreateFileA ReadFile GetFileSize CloseHandle GetTempPathA DeleteFileA MultiByteToWideChar GlobalAlloc GlobalLock WriteFile GlobalUnlock GlobalFree CreateToolhelp32Snapshot Process32First GetTickCount VirtualAlloc GetModuleHandleA GetPrivateProfileStringA CreateThread WideCharToMultiByte GetSystemTime WritePrivateProfileStringA GetModuleFileNameA SetFilePointer CreateMutexA GetLastError OpenFileMappingA MapViewOfFile UnmapViewOfFile lstrcmpiA lstrlenA ExitProcess lstrcmpA Sleep VirtualProtect lstrcpyA FreeLibrary GetProcAddress LoadLibraryA lstrcatA GetSystemDirectoryA Process32Next OutputDebugStringA

user32

PostThreadMessageA SetWindowsHookExA CallNextHookEx GetSystemMetrics EnumWindows PrintWindow GetDC ReleaseDC IsRectEmpty GetWindowTextA IsWindowVisible IsIconic GetActiveWindow ShowWindow SetForegroundWindow FindWindowA FindWindowExA GetWindowThreadProcessId GetWindowInfo

gdi32

RealizePalette DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits GetObjectA CreateDCA GetDeviceCaps DeleteDC GetStockObject SelectPalette

ws2_32

gethostbyname inet_ntoa

gdiplus

GdipGetImageEncodersSize GdipSaveImageToFile GdipCloneImage GdipLoadImageFromFile GdipDisposeImage GdipAlloc GdipFree GdiplusStartup GdipGetImageEncoders GdiplusShutdown

wininet

HttpAddRequestHeadersA InternetCloseHandle InternetOpenA InternetConnectA HttpOpenRequestA HttpSendRequestExA HttpEndRequestA

msvcrt

??2@YAPAXI@Z ??3@YAXPAX@Z atoi malloc free strstr memmove ??1type_info@@UAE@XZ memset memcpy _except_handler3 _local_unwind2